Kiteworks Secure Forms CVE-2026-23638

Exploitation requires an active, authenticated Kiteworks account with at least low-level privileges (CVSS PR:L confirmed). The vulnerability is specific to the Secure Data Forms module's approval flow configuration functionality - deployments that do not use Secure Data Forms are not exposed to this attack surface. The attacker must be able to identify or enumerate object reference IDs for forms owned by other users, which may require some reconnaissance within the platform. No user interaction from the victim is required (UI:N). Exploitation is bounded to integrity impact only - the attacker can modify approval configurations but cannot read confidential data or cause availability disruption (C:N/A:N per CVSS). The unchanged scope (S:U) indicates the attack cannot pivot beyond the Kiteworks application boundary to affect other systems.

The CVSS base score of 6.5 (Medium) is consistent with the observed signal profile: the attack vector is network-based (AV:N), complexity is low (AC:L), and no user interaction is required (UI:N), meaning exploitation is straightforward once access is obtained. The PR:L requirement (low-privilege authenticated) is the primary limiting factor, narrowing the attacker pool to users who already hold a Kiteworks account. The integrity impact is rated High (I:H) while confidentiality and availability are unaffected (C:N/A:N), indicating the primary risk is unauthorized modification of business-critical approval workflows rather than data exfiltration. No EPSS score was provided in available data, so probabilistic exploitation likelihood cannot be quantified. The absence of a KEV listing and no identified public POC suggests exploitation is not currently widespread, but the low attack complexity means a motivated insider or compromised account could readily exploit this without advanced skill. Overall this represents a real but bounded risk - highest for multi-tenant or enterprise Kiteworks deployments where approval workflow integrity is business-critical.

An authenticated Kiteworks user with a standard low-privileged account accesses the Secure Data Forms module and identifies or enumerates the object reference ID of an approval flow configuration belonging to a different user, potentially by observing ID patterns from their own forms. The attacker then submits a crafted API request substituting the victim's form ID, modifying that user's approval flow configuration - such as adding unauthorized approvers or bypassing required approval steps - without any elevated privileges or victim interaction. No public exploit code has been identified at time of analysis, but the low complexity makes manual exploitation feasible with basic API knowledge.